deps: Bump the npm group with 7 updates

[dependabot]

Bumps the npm group with 7 updates:

Package	From	To
terser	5.49.0	5.50.0
open	11.0.0	11.0.1
yargs	18.0.0	18.1.0
minimatch	10.2.5	10.2.6
@parcel/watcher	2.5.6	2.6.0
node-stream-zip	1.15.0	1.16.0
ws	8.21.1	8.21.3

Updates terser from 5.49.0 to 5.50.0

Changelog

Sourced from terser's changelog.

v5.50.0

• Experimental TypeScript type stripping
• Fixed a crash in mozilla AST conversion of imports

v5.49.2

• Fixed a crash related to dynamic import expressions

v5.49.1

• Correctly parenthesize tagged template strings where the tag is new something(), which also has parentheses
• Internally changed how import() expression is parsed, it is no longer treated as a function call.

Commits

• 0868263 5.50.0
• 6369c68 update changelog
• e32443b experimental type stripping (#1718)
• f41d858 Update actions/setup-node action to v7 (#1708)
• 9fdbd4d Update actions/checkout action to v7 (#1695)
• f1b0e04 fix crash in mozilla AST conversion of imports
• f1f0594 add mutation test
• 25984c8 5.49.2
• 60de130 update changelog
• 067113d fix crash with dynamic imports
• Additional commits viewable in compare view

Updates open from 11.0.0 to 11.0.1

Release notes

Sourced from open's releases.

v11.0.1

• Fix WSL failure when the working directory is unreachable from Windows 6ac3fe4

---

sindresorhus/open@v11.0.0...v11.0.1

Commits

• f38acc8 11.0.1
• 6ac3fe4 Fix WSL failure when the working directory is unreachable from Windows
• a30acc7 Meta tweaks
• See full diff in compare view

Updates yargs from 18.0.0 to 18.1.0

Changelog

Sourced from yargs's changelog.

18.1.0 (2026-07-26)

Features

• ignore bun when getting bin name (b77831c)

Bug Fixes

• lang: 'count' for de locale (#2476) (971e351)
• local prototype pollution vulnerability in apply-extends (437f3a4)
• locale: add Georgian translation (#2474) (086aeaa)

17.7.3 (2026-06-19)

Bug Fixes

• fix: use entry point with file extension for anything that supports exports (#2514) (c7597e3)

16.2.2 (2026-06-19)

Bug Fixes

• fix: use entry point with .cjs file extension for yargs export (#2546) (6feb819)

Commits

• 8878a89 chore(main): release 18.1.0 (#2475)
• db916b4 chore: add workflow_dispatch for release-please (#2564)
• 4153e0f chore: improve build robustness (#2554)
• 186d2e6 docs: clarify nargs option-like values (#2551)
• c615633 docs: fix various typos in source code (#2525)
• 7c76d0a docs: fix broken links in api.md (#2549)
• 37e2e5b chore: fix .wrap() docs (#2493)
• 547e300 chore: update the easy dependencies (#2552)
• e086681 chore(deps): update dependency cross-env to v10 (#2480)
• 88f548c chore: fix typos (#2492)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by shadowspawn, a new releaser for yargs since your current version.

Updates minimatch from 10.2.5 to 10.2.6

Commits

• ded1bbd 10.2.6
• 0215dfe update deps and lint
• 10968ea improve test for .. eating drive letters
• See full diff in compare view

Updates @parcel/watcher from 2.5.6 to 2.6.0

Release notes

Sourced from @​parcel/watcher's releases.

v2.6.0

Adds support RegExp ignores in parcel-bundler/watcher#248. Thanks @​SimenB!

Commits

• 01c4add v2.6.0
• 2392f96 fix ci
• 2d44c97 update ci
• e0c2dec only test on node lts
• 66e8e76 fix: use assert.rejects for async subscribe throw test (#254)
• a1b86cf chore: run prettier (#249)
• 4aa3dca feat: support RegExp ignores (#248)
• See full diff in compare view

Updates node-stream-zip from 1.15.0 to 1.16.0

Changelog

Sourced from node-stream-zip's changelog.

v1.16.0 (2026-07-22)

+ fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

Commits

• 2d9da01 release 1.16.0
• d6646bf up deps
• b9b496a fixed reading compressed entry size
• a050b3f fixed tests
• 7c5d503 readme
• c7cd392 removed a duplicated test
• f58b5b8 node.js 14
• 74f30a3 node.js 12
• 571f55b node.js 12
• See full diff in compare view

Updates ws from 8.21.1 to 8.21.3

Release notes

Sourced from ws's releases.

8.21.3

Bug fixes

• The server now correctly rejects permessage-deflate offers if the incoming client_max_window_bits parameter value is smaller than its configured clientMaxWindowBits (e97a20ea).

8.21.2

Bug fixes

• Fixed a test for CITGM (2eb3be0b).

Commits

• c791e70 [dist] 8.21.3
• e97a20e [fix] Reject offers with client_max_window_bits below config
• 787ebf2 [dist] 8.21.2
• b4d62eb Revert "[ci] Trust Coveralls Homebrew tap"
• e4bb883 [security] Use GitHub PVR as main reporting channel
• 2eb3be0 [test] Skip test on Node.js versions where it does not apply
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions